Skip to main content
crispy
crispy
New Member
November 10, 2015
Question

IPS Rule to detect and block DNS Recursion

  • November 10, 2015
  • 1 reply
  • 4846 views

Hi,

 

 Thought I would share this with the community. I ended up writing a IPS rule to detect others trying to use our Windows DNS Servers as open resolvers and causing a DDoS against others DNS servers. The rule I wrote detects more than 5 recursive queries per minute and then quarantines the src IP address for a period of time. Hopefully someone else might also find this useful, or be able to adapt it further.

 

Rather than repost everything again, the link to the article is here http://cwispy.com/ips-rule-to-block-dns-recursion/

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 10, 2015

    hi,

     

    thanks for posting your custom IPS rule, sadly there are not many published on the forums.

    What bites me it that if you have a FGT in front of your Windows DNS, why don't you control access (or block it altogether) from WAN to it via the policy? I guess it still is an open resolver...

    crispy
    crispyAuthor
    New Member
    November 10, 2015

    Hi,

     

     We can not deny access to the servers entirely as they are authorative servers for some domain names. What we need to do is implement a couple of resolvers for the Windows network and then turn off recursion on the authoritative servers which will fix the issue. But until then, this solution has been working very well.

     

    crispy

    Terms & ConditionsAccessibility statement